Data Security Architect

The Data Security Architect

The Data Security Architect is responsible for defining the enterprise architecture, control patterns, and design standards for protecting sensitive data across IDEXX’s platforms, including Snowflake, Databricks, M365, Box, and cloud applications (AWS‑first). This role ensures that data security capabilities—such as DSPM, DLP, and data platform controls—are designed correctly, integrated across systems, and scalable, enabling consistent protection of sensitive data across the enterprise.

This is a design and architecture leadership role, focused on the “how” of data protection, not day-to-day program execution or tool operations.

• Data Security Architecture & Design – Define the enterprise data security architecture, including data discovery and classification (DSPM integration), DLP/CASB control strategy (M365, Box, endpoint), data platform security controls (Snowflake, Databricks), and application/API data protection patterns (cloud‑first).
• Standard Control Patterns – Establish standard control patterns, including data classification and tagging models, encryption, tokenization, and masking strategies, data access control models (RBAC, ABAC, RLS), and data movement and sharing controls.
• Platform Integration & Control Alignment – Design and drive integration across Snowflake and Alation, Entra , M365 and Box, and cloud environments (AWS, Azure, GCP). Ensure alignment between DSPM findings, DLP policies, and data platform controls.
• Reference Architecture & Engineering Enablement – Develop and maintain a Data Security Reference Architecture, define secure design patterns and implementation guidance for data engineering, application development, and cloud platform teams, and enable engineering teams to embed data protection into systems and workflows.
• Collaboration with Program & Engineering Teams – Partner with the Data Security Program Lead, Data Security Engineering Lead, and Cyber Defense/SOC teams to provide architectural direction and design input, ensuring that execution teams can implement effectively and controls remain aligned to risk priorities.
• Standards, Governance & Continuous Improvement – Define and evolve data protection standards aligned to data management policy and regulatory requirements, evaluate emerging capabilities, and continuously improve architecture based on new data risks, platform evolution, and feedback.

• 7‑10+ years of experience in data security, cloud security, or security architecture.
• Strong experience designing security for cloud‑native data platforms (Snowflake, Databricks), SaaS and collaboration environments (M365, Box), and enterprise identity systems (Entra ).
• Proven ability (via outcomes) to design and scale data classification and tagging models, data protection controls (DLP, masking, encryption), and access control models (RBAC, ABAC).
• Experience working across data engineering, application engineering, and cloud platform teams.
• Deep understanding of data protection architecture, data platforms, and cloud environments; familiarity with DSPM tools, CASB/DLP platforms, and data catalog tools.
• Knowledge of encryption, tokenization, data masking techniques, access governance models, and regulatory frameworks (GDPR, SOC2, PCIDSS).
• Leadership and professional skills: strong architectural thinking, ability to translate business data risk into technical architecture, excellent collaboration, and communication skills.
• Location:
  
  preferred candidate based in North Hampshire or Maine willing to travel to the HQ in Westbrook, Maine for a flexible hybrid schedule of 8 days per month.
• Preferred experience:
  
  implementing enterprise data security or DSPM programs, designing controls in Snowflake or similar platforms, and holding certifications such as AWS Certified Solutions Architect, CISSP, or CCSP.

• Base annual salary target: $120,000 - $150,000.
• Opportunity for annual cash bonus.
• Health, dental, and vision benefits starting Day‑One.
• 5% 401(k) matching.
• Additional benefits: financial support, pet insurance, mental health resources, volunteer paid days off, employee stock program, foundation donation matching, and more.

We are an equal‑opportunity employer. Applicants will not be discriminated against because of race, color, creed, sex, sexual orientation, gender identity or expression, age, religion, national origin, citizenship status, disability, ancestry, marital status, veteran status, medical condition, or any protected category prohibited by local, state, or federal laws.